Add files via upload

Model/PYAS_Model.json

@@ -1,17 +1,11 @@
 {
-    "Suffix": [".bat", ".cmd", ".dll", ".exe", ".js", ".ps1", ".sys", ".vbs", ".com"], 
+    "Labels": ["White/Pefile", "White/Script", "Virus/Pefile", "Virus/Script"], 
 
-    "Labels": ["White/BAT-File", "White/CMD-File", "White/DLL-File", "White/EXE-File", 
-               "White/JS-File", "White/PS1-File", "White/SYS-File", "White/VBS-File",
-               "Virus/BAT-File", "Virus/CMD-File", "Virus/DLL-File", "Virus/EXE-File", 
-               "Virus/JS-File", "Virus/PS1-File", "Virus/SYS-File", "Virus/VBS-File"], 
+    "Detect": ["Virus/Pefile", "Virus/Script"],  
 
-    "Detect": ["Virus/BAT-File", "Virus/CMD-File", "Virus/DLL-File", "Virus/EXE-File", 
-               "Virus/JS-File", "Virus/PS1-File", "Virus/SYS-File", "Virus/VBS-File"],  
+    "Models": ["PYAS_Model_A1.onnx"], 
 
-    "Models": ["PYAS_Model_A1.onnx", "PYAS_Model_A2.onnx", "PYAS_Model_A3.onnx"], 
-
-    "Pixels": [224, 224], 
+    "Pixels": [300, 300], 
 
     "Values": 95
 }

PYAS.py

@@ -1,6 +1,6 @@
 import os, gc, sys, time, json, psutil
-import msvcrt, ctypes, pyperclip, win32file
-import win32gui, win32api, win32con
+import ctypes, struct, msvcrt, pyperclip
+import win32gui, win32api, win32con, win32file
 from PYAS_Engine import YRScan, DLScan
 from PYAS_Suffixes import slist, alist
 from PYAS_Language import translate_dict
@@ -19,7 +19,7 @@ class MainWindow_Controller(QMainWindow):
         self.pyas = sys.argv[0].replace("\\", "/")
         self.dir = os.path.dirname(self.pyas)
         self.pyae_version = "AI Engine"
-        self.pyas_version = "3.1.6"
+        self.pyas_version = "3.1.8"
         self.first_startup = True
         self.init_data_base()
         self.init_tray_icon()
@@ -926,12 +926,12 @@ class MainWindow_Controller(QMainWindow):
             label, level = self.model.dl_scan(file)
             if label and label in self.model.detect:
                 if self.json["high_sensitive"]:
-                    return "Virus/Deep-Learning"
+                    return label
                 elif level >= self.model.values:
-                    return "Virus/Deep-Learning"
+                    return label
             if self.json["extension_kits"]:
                 if self.rules.yr_scan(file):
-                    return "Virus/Yara-Detected"
+                    return "Virus/Rules"
             return False
         except:
             return False
@@ -1299,7 +1299,7 @@ class MainWindow_Controller(QMainWindow):
 
     def protect_proc_thread(self):
         while self.proc_protect:
-            time.sleep(0.01)
+            time.sleep(0.1)
             new_process = set()
             for p in psutil.process_iter():
                 new_process.add(p.pid)
@@ -1330,6 +1330,8 @@ class MainWindow_Controller(QMainWindow):
                     self.kill_process("病毒攔截", p, file, False)
                 elif self.load_scan(p):
                     self.kill_process("加載攔截", p, file, False)
+                elif self.memory_scan(p):
+                    self.kill_process("記憶體攔截", p, file, False)
                 elif ":/Windows" not in file and ":/Program" not in file:
                     if os.path.exists(file):
                         self.track_proc = p, file, True
@@ -1338,7 +1340,7 @@ class MainWindow_Controller(QMainWindow):
 
     def load_scan(self, p):
         try:
-            for entry in p.memory_maps():
+            for entry in p.memory_maps(grouped=True):
                 file = str(entry.path).replace("\\", "/")
                 if ":/Windows" not in file and file not in self.whitelist:
                     ftype = str(f".{file.split('.')[-1]}").lower()
@@ -1348,23 +1350,53 @@ class MainWindow_Controller(QMainWindow):
         except:
             return False
 
+    def get_executable_section(self, process_handle, base_address):
+        dos_header = ctypes.create_string_buffer(64)
+        ctypes.windll.kernel32.ReadProcessMemory(process_handle,
+        ctypes.c_void_p(base_address), dos_header, 64, None)
+        nt_headers_offset = struct.unpack("<I", dos_header[0x3C:0x3C + 4])[0]
+        nt_headers = ctypes.create_string_buffer(248)
+        ctypes.windll.kernel32.ReadProcessMemory(process_handle,
+        ctypes.c_void_p(base_address + nt_headers_offset), nt_headers, 248, None)
+        number_of_sections = struct.unpack("<H", nt_headers[6:8])[0]
+        optional_header_size = struct.unpack("<H", nt_headers[20:22])[0]
+        section_headers_offset = nt_headers_offset + 24 + optional_header_size
+        for i in range(number_of_sections):
+            section_header = ctypes.create_string_buffer(40)
+            section_address = base_address + section_headers_offset + i * 40
+            ctypes.windll.kernel32.ReadProcessMemory(process_handle,
+            ctypes.c_void_p(section_address), section_header, 40, None)
+            section_name = section_header[:8].rstrip(b'\x00').decode()
+            virtual_address = struct.unpack("<I", section_header[12:16])[0]
+            virtual_size = struct.unpack("<I", section_header[8:12])[0]
+            characteristics = struct.unpack("<I", section_header[36:40])[0]
+            if (characteristics & 0x20000000 and characteristics & 0x40000000 and
+                virtual_size > 0):
+                return base_address + virtual_address, virtual_size
+        return None, 0
+
+    def get_module_base(self, p):
+        try:
+            for entry in p.memory_maps(grouped=False):
+                file = str(entry.path).replace("\\", "/")
+                ftype = str(f".{file.split('.')[-1]}").lower()
+                if ftype in [".exe"] and file not in self.whitelist:
+                    return int(entry.addr, 16)
+            return False
+        except:
+            return False
+
     def memory_scan(self, p):
         try:
-            memory_bytes = {}
-            m = ctypes.windll.kernel32.OpenProcess(0x1F0FFF, False, p.pid)
-            for memory_range in p.memory_maps(grouped=False):
-                base_addr = int(memory_range.addr, 16)
-                buffer = ctypes.create_string_buffer(memory_range.rss)
-                if ctypes.windll.kernel32.ReadProcessMemory(m, ctypes.c_void_p(base_addr),
-                    buffer, memory_range.rss, ctypes.byref(ctypes.c_size_t(0))):
-                    file = str(memory_range.path).replace("\\", "/")
-                    memory_bytes.setdefault(file, bytearray()).extend(buffer.raw)
-            for file, data in memory_bytes.items():
-                ftype = str(f".{file.split('.')[-1]}").lower()
-                if ":/Windows" not in file and file not in self.whitelist:
-                    if self.start_scan(file) or self.start_scan(bytes(data)):
-                        return True
-            ctypes.windll.kernel32.CloseHandle(m)
+            base_address = self.get_module_base(p)
+            process_handle = ctypes.windll.kernel32.OpenProcess(0x1F0FFF, False, p.pid)
+            text_addr, text_size = self.get_executable_section(process_handle, base_address)
+            buffer = ctypes.create_string_buffer(text_size)
+            if ctypes.windll.kernel32.ReadProcessMemory(process_handle,
+            ctypes.c_void_p(text_addr), buffer, text_size, ctypes.byref(ctypes.c_size_t(0))):
+                if self.start_scan(buffer.raw):
+                    return True
+            ctypes.windll.kernel32.CloseHandle(process_handle)
             return False
         except:
             return False
@@ -1420,10 +1452,11 @@ class MainWindow_Controller(QMainWindow):
                             self.ransom_counts += 1
                         elif action == 4 and ftype in alist:
                             self.ransom_counts += 1
-                    if action == 3 and ftype in slist and self.start_scan(fpath):
-                        self.ransom_counts = 0
-                        os.remove(fpath)
-                        self.send_notify(self.trans("病毒刪除: ")+fpath, True)
+                    if ":/Windows" not in fpath and ftype in slist:
+                        if action == 3 and self.start_scan(fpath):
+                            self.ransom_counts = 0
+                            os.remove(fpath)
+                            self.send_notify(self.trans("病毒刪除: ")+fpath, True)
                 except:
                     pass
         if self.ui.Protection_switch_Button_2.text() == self.trans("已開啟"):

PYAS_Engine.py

@@ -1,6 +1,6 @@
 import os, io, sys, time, json, yara
-import numpy, onnxruntime
-from PIL import Image#, ImageShow
+import numpy, pefile, onnxruntime
+from PIL import Image, ImageShow
 
 class YRScan:
     def __init__(self):
@@ -36,39 +36,38 @@ class DLScan:
         self.values = 100
 
     def load_model(self, file_path):
-        ftype = str(f".{file_path.split('.')[-1]}").lower()
-        if ftype in [".json", ".txt"]:
-            self.class_names = json.load(open(file_path, 'r'))
-        self.values = self.class_names['Values']
-        self.detect = self.class_names['Detect']
-        available_providers = onnxruntime.get_available_providers()
-        preferred_providers = [
+        try:
+            ftype = str(f".{file_path.split('.')[-1]}").lower()
+            if ftype in [".json", ".txt"]:
+                with open(file_path, 'r') as f:
+                    self.class_names = json.load(f)
+            self.values = self.class_names['Values']
+            self.detect = self.class_names['Detect']
+            available_providers = onnxruntime.get_available_providers()
+            preferred_providers = [
             'CUDAExecutionProvider', 'ROCmExecutionProvider',
             'OpenVINOExecutionProvider', 'DirectMLExecutionProvider',
             'AzureExecutionProvider', 'CPUExecutionProvider']
-        providers = [p for p in preferred_providers if p in available_providers]
-        for model in self.class_names['Models']:
-            try:
+            providers = [p for p in preferred_providers if p in available_providers]
+            for model in self.class_names['Models']:
                 model_path = os.path.join(os.path.dirname(file_path), model)
                 try:
-                    self.models[model] = onnxruntime.InferenceSession(model_path, providers=providers)
+                    self.models[model] = onnxruntime.InferenceSession(
+                    model_path, providers=providers)
                 except Exception as e:
-                    providers = ['CPUExecutionProvider']
-                    self.models[model] = onnxruntime.InferenceSession(model_path, providers=providers)
-            except:
-                pass
+                    self.models[model] = onnxruntime.InferenceSession(
+                    model_path, providers=['CPUExecutionProvider'])
+        except Exception as e:
+            pass
 
     def dl_scan(self, file_path):
         try:
             if isinstance(file_path, str):
-                ftype = str(f".{file_path.split('.')[-1]}").lower()
-                if ftype in self.class_names['Suffix']:
-                    with open(file_path, 'rb') as f:
-                        file_path = f.read()
-                else:
-                    return False, False
+                file_data = self.check_file_type(file_path)
+            else:
+                file_data = file_path
             target_size, sim = tuple(self.class_names['Pixels']), {}
-            image = self.preprocess_image(file_path, target_size)
+            image = self.preprocess_image(file_data, target_size)
             image_array = numpy.array(image).astype('float32') / 255.0
             image_expand = numpy.expand_dims(image_array, axis=0)
             for model_name, model in self.models.items():
@@ -78,21 +77,36 @@ class DLScan:
                 label = self.class_names['Labels'][number].replace("\n", "")
                 sim[label] = sim.setdefault(label, 0) + pre_answer[number]
             for local_label, sim_sum in sim.items():
-                if sim[local_label] > len(self.models) / 2:
+                if sim_sum > len(self.models) / 2:
                     local_level = sim_sum / len(self.models)
-            if ftype in str(f".{local_label.split('/')[-1].split('-')[0]}").lower(): #
-                return local_label, local_level * 100
+                    return local_label, local_level * 100
             return False, False
         except Exception as e:
-            print(f"Error during scan: {e}")
             return False, False
 
-    def preprocess_image(self, file_data, target_size): # New
+    def check_file_type(self, file_path):
+        try:
+            ftype = str(f".{file_path.split('.')[-1]}").lower()
+            if ftype in [".exe", ".dll", ".sys", ".com"]:
+                with pefile.PE(file_path, fast_load=True) as pe:
+                    for section in pe.sections:
+                        if (section.Characteristics & pefile.SECTION_CHARACTERISTICS['IMAGE_SCN_MEM_EXECUTE'] and
+                        section.Characteristics & pefile.SECTION_CHARACTERISTICS['IMAGE_SCN_MEM_READ'] and
+                        section.SizeOfRawData > 0 and section.Name.decode().strip('\x00').lower() in [".text"]):
+                            return section.get_data()
+            elif ftype in [".bat", ".cmd", ".vbs", ".ps1"]:
+                with open(file_path, 'rb') as f:
+                    return f.read()
+            return False
+        except Exception as e:
+            return False
+
+    def preprocess_image(self, file_data, target_size):
         file_data = numpy.frombuffer(file_data, dtype=numpy.uint8)
         data_count = len(file_data)
         wah = int(numpy.ceil(numpy.sqrt((data_count + 2) // 3)))
         image_array = numpy.zeros((wah * wah * 3,), dtype=numpy.uint8)
         image_array[:data_count] = file_data
         image_array = image_array.reshape((wah, wah, 3))
-        image = Image.fromarray(image_array) #ImageShow.show(image)
+        image = Image.fromarray(image_array)
         return image.resize(target_size, Image.Resampling.LANCZOS)

PYAS_Version.py

@@ -2,7 +2,7 @@ import pyinstaller_versionfile
 
 pyinstaller_versionfile.create_versionfile(
 output_file="versionfile.txt",
-version='3.1.6',
+version='3.1.8',
 company_name="PYAS Security",
 file_description="Python Antivirus Software",
 internal_name="PYAS",

README.md

@@ -1,6 +1,6 @@
 # PYAS (Python Antivirus Software)
 
-![PYAS](https://github.com/87owo/PYAS/assets/85057800/8136aaca-d388-4321-bedb-abc4fcecfa8b)
+![PYAS](https://github.com/user-attachments/assets/39c273b9-c467-480a-a8b3-31714a6df3ef)
 
 ## Readme Language
 
@@ -24,12 +24,7 @@ PyQt5==5.15.9
 ```
 PYAS/
 ├── Driver/
-│   ├── PYAS_Driver.sys -------> Extension Kit (self protection driver for pyas by 0sha0)
-│   └── ...
-│
-├── Exten/
-│   ├── bitdefender/ ----------> Extension Kit (bitdefender windows console scan engine)
-│   ├── pe_sieve/ -------------> Extension Kit (pe sieve windows console memory engine)
+│   ├── PYAS_Driver.sys -------> Driver Protect (self protection driver for pyas by 0sha0)
 │   └── ...
 │
 ├── Model/
@@ -41,10 +36,9 @@ PYAS/
 │   ├── Yara_Rules.yrc ---------> Compile Rules (yara rules in compiled format)
 │   └── ...
 │
-├── PYAS.* ---------------------> Main PYAS Program (including animation, scan, protect functions, ...)
+├── PYAS.py ---------------------> Main PYAS Program (including animation, scan, protect functions, ...)
 ├── PYAS_Engine.py -------------> Conversion Database (used to transform profiles and forecast data)
 ├── PYAS_Suffixes.py -----------> File Suffixes (including scanned file suffixes and common suffixes)
-├── PYAS_Extension.py ----------> Extension Kit (extension scanners developed by other developers)
 ├── PYAS_Interface.py ----------> PyQt5 Interface (use QT designer, must be matched with the main program)
 ├── PYAS_Resource.py -----------> PyQt5 Resource (status pictures, icon packages, button icons, ...)
 ├── PYAS_Language.py -----------> Translate Dict (Traditional Chinese, Simplified Chinese, English)
@@ -58,6 +52,10 @@ https://pyantivirus.wixsite.com/pyas
 
 https://github.com/87owo/PYAS
 
+## Microsoft Runtime
+
+https://github.com/87owo/Microsoft_Runtime/releases
+
 ## PYAS Driver
 
 https://github.com/0sha0/PYAS_Protection

README_zh_CN.md

@@ -1,6 +1,6 @@
 # PYAS (Python 杀毒软件)
 
-![PYAS](https://github.com/87owo/PYAS/assets/85057800/8136aaca-d388-4321-bedb-abc4fcecfa8b)
+![PYAS](https://github.com/user-attachments/assets/39c273b9-c467-480a-a8b3-31714a6df3ef)
 
 ## 安装要求
 
@@ -21,11 +21,6 @@ PYAS/
 │   ├── PYAS_Driver.sys -------> 驱动程序 (0sha0 为 pyas 提供的自我保护驱动程序)
 │   └── ...
 │
-├── Exten/
-│   ├── bitdefender/ ----------> 扩展套件 (bitdefender windows 控制台扫描引擎)
-│   ├── pe_sieve/ -------------> 扩展套件 (pe sieve windows 控制台内存引擎)
-│   └── ...
-│
 ├── Model/
 │   ├── PYAS_Model.json -------> 病毒数据库 (数据库必须位于指定目录中)
 │   └── ...
@@ -35,14 +30,13 @@ PYAS/
 │   ├── Yara_Rules.yrc ---------> 编译规则 (编译格式的 yara 规则)
 │   └── ...
 │
-├── PYAS.* ---------------------> PYAS主程序（包含动画、扫描、保护等功能...）
+├── PYAS.py ---------------------> PYAS主程序（包含动画、扫描、保护等功能...）
 ├── PYAS_Engine.py -------------> 转换数据库（用于转换剖面图和预报数据）
 ├── PYAS_Suffixes.py -----------> 文件后缀（包含扫描文件后缀和常用后缀）
-├── PYAS_Extension.py ----------> 扩展工具包（其他开发者开发的扩展扫描器）
 ├── PYAS_Interface.py ----------> PyQt5界面（使用QT设计器，需与主程序搭配使用）
 ├── PYAS_Resource.py -----------> PyQt5资源（状态图片、图标包、按钮图标...）
 ├── PYAS_Language.py -----------> 翻译词典（繁体中文、简体中文、英文）
-├── PYAS_Version.py ------------> 安裝信息（文件信息、版本信息、原名，...）
+├── PYAS_Version.py ------------> 安裝信息（文件信息、版本信息、原名...）
 └── ...
 ```
 
@@ -52,14 +46,18 @@ https://pyantivirus.wixsite.com/pyas
 
 https://github.com/87owo/PYAS
 
-## 开源协议
+## 微软运行库
 
-https://github.com/87owo/PYAS/blob/main/LICENSE.md
+https://github.com/87owo/Microsoft_Runtime/releases
 
 ## 驱动程序
 
 https://github.com/0sha0/PYAS_Protection
 
+## 开源协议
+
+https://github.com/87owo/PYAS/blob/main/LICENSE.md
+
 ## 支援系统
 
 Windows 8.1, 10, 11 (64-bit), 内存 500MB, 存储 200MB 或更高

README_zh_TW.md

@@ -1,6 +1,6 @@
 # PYAS (Python 防毒軟體)
 
-![PYAS](https://github.com/87owo/PYAS/assets/85057800/8136aaca-d388-4321-bedb-abc4fcecfa8b)
+![PYAS](https://github.com/user-attachments/assets/39c273b9-c467-480a-a8b3-31714a6df3ef)
 
 ## 安裝要求
 
@@ -21,11 +21,6 @@ PYAS/
 │   ├── PYAS_Driver.sys -------> 驅動程式 (0sha0 為 pyas 提供的自我保護驅動程式)
 │   └── ...
 │
-├── Exten/
-│   ├── bitdefender/ ----------> 擴充套件 (bitdefender windows 控制台掃描引擎)
-│   ├── pe_sieve/ -------------> 擴充套件 (pe sieve windows 控制台記憶體引擎)
-│   └── ...
-│
 ├── Model/
 │   ├── PYAS_Model.json -------> 病毒資料庫 (資料庫必須位於指定目錄)
 │   └── ...
@@ -35,14 +30,13 @@ PYAS/
 │   ├── Yara_Rules.yrc ---------> 編譯規則 (編譯格式的 yara 規則)
 │   └── ...
 │
-├── PYAS.* ---------------------> PYAS主程式（包含動畫、掃描、保護等功能...）
+├── PYAS.py ---------------------> PYAS主程式（包含動畫、掃描、保護等功能...）
 ├── PYAS_Engine.py -------------> 轉換資料庫（用於轉換剖面圖和預報資料）
 ├── PYAS_Suffixes.py -----------> 文件後綴（包含掃描文件後綴和常用後綴）
-├── PYAS_Extension.py ----------> 擴充工具包（其他開發者開發的擴充掃描器）
 ├── PYAS_Interface.py ----------> PyQt5介面（使用QT設計器，需與主程式搭配使用）
 ├── PYAS_Resource.py -----------> PyQt5資源（狀態圖片、圖示包、按鈕圖示...）
 ├── PYAS_Language.py -----------> 翻譯字典（繁體中文、簡體中文、英文）
-├── PYAS_Version.py ------------> 安裝資訊（檔案資訊、版本資訊、原名，...）
+├── PYAS_Version.py ------------> 安裝資訊（檔案資訊、版本資訊、原名...）
 └── ...
 ```
 
@@ -52,14 +46,18 @@ https://pyantivirus.wixsite.com/pyas
 
 https://github.com/87owo/PYAS
 
-## 開源協議
+## 微軟運行庫
 
-https://github.com/87owo/PYAS/blob/main/LICENSE.md
+https://github.com/87owo/Microsoft_Runtime/releases
 
 ## 驅動程式
 
 https://github.com/0sha0/PYAS_Protection
 
+## 開源協議
+
+https://github.com/87owo/PYAS/blob/main/LICENSE.md
+
 ## 支援系統
 
 Windows 8.1, 10, 11 (64-bit),記憶體 500MB, 磁碟容量 200MB 或更高